DataEase, an open‑source data visualization and analysis platform, validates H2 JDBC URLs to prevent malicious parameters. The validation logic can be bypassed when special Unicode characters undergo different case‑conversion in DataEase versus H2, allowing attackers to inject forbidden parameters such as "init" into the connection string. This flaw constitutes a code injection weakness (CWE-94) and permits an attacker to run arbitrary code on the host where DataEase is deployed, compromising confidentiality, integrity, and availability.

Any DataEase installation running a version earlier than 2.10.24 is affected if it uses the H2 database integration. Users of the product who can influence connection strings, such as through web interfaces or APIs, are susceptible until the fix is applied by upgrading to version 2.10.24 or later.

The CVSS base score of 8.7 indicates high severity. The EPSS score of < 1% suggests a very low likelihood of exploitation at present, and the vulnerability is not yet listed in KEV. The likely attack vector is the delivery of a specially crafted JDBC URL that contains prohibited parameters; any party capable of controlling the connection string can trigger the flaw, enabling remote code execution on the DataEase host.